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Method for generating digital watenmarks and for exchanging data containing digital 
watennarks 



(57) A method for generating digital watermarks 
and for exchanging data containing such watermarks is 
described. The system is t>ased on an watermarking 
technique which is robust against image transformation 
techniques such as compression, rotation, translation, 
and scaling. It uses modulation of the magnitude com- 
ponents in Fourier space and adds/reads a template in 
the log polar transform of the magnitude components. 
The template is used for analyzing scaling and rotation. 
In addition, the system applies cryptographic protocols 
and public key techniques for both, encoding the water- 
mark and transferring watermarked data. Preferably, an 
author (ICH) encodes the watermark using an asym- 
metric cryptographic key pair provided by a public key 
infrastructure (PKI) and registers the watermarked data - 
at a trusted registration party (ICO) before transmitting 
the data to a receiving party (IB). The latter can use the 
public key infrastructure (PKI) for verifying authorship. 
Transmission between the parties uses data protection 
provided by the cryptographic keys. 
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Description 

[0001] The present invention relates to a method for 
generating digital watermarks and for transmitting data 
containing digital watermarks according to the preamble 
o-f the independent claims. 

[O002] Digital watermarking is a method for marking 
data sets, such as images, sound or video. A digital 
watermark consists of a slight modification of the data 
set that does not affect the data set's usability but that 
can be detected using dedicated analysis software or 
apparatus. Watermarking can e.g. be used for marking 
authorship or ownership of a data set. 
[O003] Digital watermarking can be seen as a funda- 
mental-problem in digital communications (see e.g. I. 
Cox. J. Killian, T. Leightoh, and T. Shamoon. "Secure 
spread spectrum communication for multimedia'*. Tech- 
nical report, N.E.C. Research Institute, 1995). Early 
methods of encoding watermarks consisted of no more 
than incrementing an image component to encode a 
binary 'V and decrementing to encode a '0' (G. Caronni 
"Assuring Ownership Rights for Digital Images" in H. H. 
Brueggemann and W. Gerhardt-HaecW, editors. Relia- 
ble IT Systems VIS '95, Vieweg Publishing Company, 
Germany. 1995). Tirkel etal. (A. Z. Tirkel. G. A. Rankin, 
R. G. van Schyndel, W. J. Ho. N. R. A. Mee, and C. F. 
Osborne, "Electronic watermark", in Dicta- 93, pages 
666-672, Maoquarie University, Sydney, December 
1993) and van Schyndel et al. (A. Z. Tirkel, R. G. van 
Schyndel. and C. F. Osborne, "a two-dimensional digital 
watermark", in ACCV'95, pages 378-383, University of 
Queensland, Brisbane, December 6-8 1995) have 
applied the properties of m-sequences to produce obliv- 
ious Avatermarks resistant to filtering, cropping and rea- 
sonably robust to cryptographic attack. Matsui and 
Tanaka (K. Matsui and K. Tanaka. "Video-Steganogra- 
phy : How to secretly embed a signature in a picture", in 
IMA Intellectual Property Project Proceedings, pages 
187-206, January 1994) have applied linear predictive 
coding for watermarking. Their approach to hiding a 
watermark is to make the watermark resemble quanti- 
zation noise. Tirkel and Osborne (see above) were the 
first to note the applicability of spread spectrum tech- 
niques to digital image watermarking. Since then there 
has been an increasing use of spread spectrum in dig- 
ital watermarking. It has several advantageous features, 
such as cryptographic security (see Tirkel and Osborne, 
above), and is capatsle of achieving error free transmis- 
sion of the watermark near or at the limits given by the 
maximum channel capacity (J. Smith and B. Comiskey, 
"Modulation and information hiding in images", in Ross 
Anderson, editor. Proceecfings of the First International 
Workshop in Information Hiding, Lecture Notes in Com- 
puter Science, pages 207-226, Cambridge. UK. 
May/June 1996. Springer). Fundamental information 
theoretic limits to reliable communication have been dis- 
cussed by some authors (see Smith and Comiskey. 
above). The shorter the payload of a watermark, the 



better are the chances of it being communicated relia- 
bly. Spread spectrum is an example of a symmetric key 
CTyptosystem (B. Schneier, "Applied Cryptography", 
Wiley. 2nd edition, 1995). System security is based on 
5 proprietary knowledge of the keys (or pseudo random 
seeds) which are required to embed, extract or remove 
an image watermark. One provision in the use of a 
spread spectrum system is that it is important that the 
watermarking be non-invertible because only in this way 
10 can true ownership of the copyright material be resolved 
(S. Graver. N. Memon. B. Yeo, arid M. Yeung. "Can invis- 
ible marks resolve rightful ownerships ?", IS&T/SPIE 
Electronic Imaging "97 : "Storage and Retrieval of Image 
and Video Databases". 1997). O Ruanaidh et al. (J. K. 
IS 6 Ruanaidh, W. J. Dowting. and F. M. Boland, "Phase 
watermarking of images". IEEE Irrternational Confer- 
ence on Image Processing. Lausanne, Switzerland, 
September 1996) and Cox et al. (see above) have 
developed perceptually adaptive transform domain 
20 methods for watermarking. In contrast to previous 
approaches listed above the emphasis was on embed- 
ding the watermark tn the most significant components 
of an image. The general approach used in these 
papers is to divide the image into blocks. Each block is 
25 mapped into the transform domain using either the Dis- 
crete Cosine Transform (W. B. Pennebaker and J. L 
Mitchell, "JPEG Still Image Compression Standard". 
Van Nostrand Reinhold, New York, 1993). the Had- 
amard Transform (W. G. Chambers. "Basics of Commu- 
30 nications and Coding", Oxford Science Publications. 
Qarendon Press Oxford, 1985) or the Daubechies 
Wavelet Transfbmi (W.H. Press. S.A. Teukolsky. W.T. 
Vetteriing. and B.R Rarmery. "Numerical Recipes in C". 
Cambridge University Press, second edition, 1992). 
3S Information has been embedded using the DCT (J. J. K. 
6 Ruanaidh. W. J. Dowling, and R M. Boland. "Water- 
marking digital images for copyright protection". IEEE 
Proceedings on Vision. Image and Signal Processing. 
143(4) 250-256, August 1996, based on the paper of 
40 the same title at the IEEE Conference on Image 
Processing and Its Applications, Edinburgh. July 1995) 
FFT magnitude, and phase, Wavelets (see refs. of Rua- 
naidh, Dowling and Boland. above). Linear Predictive 
Coding (see Matsui et al., above) and fractals (R Dav- 
45 ern and M. Scott. "Fractal based image steganography", 
in Ross Anderson, ed.. Proceedings of the Rrst Interna- 
tional Workshop in Information Hiding, Lecture Notes in 
Computer Science, pp. 279-294. Cannbridge, UK. 
May/June 1996. Springer Verlag). 
50 [0004] The industrial tnrportance of digital watermark- 
ing has resulted in a number of products on the market, 
either based on spread spectrum techniques or addi- 
tional registration services. They include the Picture- 
marc system by Digimarc. SureSign (former FBI's 
55 Rngerprint) by HighWater Signum. IP2 system by Intel- 
lectual Protocols, the Argent system by Digital Informa- 
tion Commodities Exchange, the PixelTag system by 
the MIT Media Lab. the SysCop system from Zhao and 
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Koch by the Frauenhofer-Institut fur Graphische Daten- 
verarbeitung (J. Zhao and E. Koch. "Embedding robust 
labels into images for copyright protection". Technical 
report. Fraunhofer Institute for Computer Graphics. 
Darmstadt. Germany. 1994. J. Zhao. "A WWW Service 5 
To Embed And Prove Digital Copyright Watermarks", 
Proc. Of the European Conference on Multimedia Appli- 
cation. Services and Techniques, Louvain-La-Neuve, 
Belgium. May 1996). and the Tigermark system from 
NEC. 

[0005] The approach of Zhao and Koch, based on the 
JPEG image compression algorithm, proceeds by seg- 
menting the image into individual 8x8 blocks. Only 
eight coefficients occupying particular positions in the 8 
X 8 block of OCT coefficients can be marked. These '15 
comprise the low frequency components of the image 
block but exclude the mean vaJue coefficient as well as 
the low frequencies. Three of the remaining OCT coeffi- 
cients are selected using a pseudo random number 
generator to convey information. The resemblance of 20 
this technique to frequency hop spread spectrum com- 
munications is also mentioned arxJ the tMocks are 
placed at random positions in the image. A WWW regis- 
tration service has been proposed for a local registra- 
tion and a local watermarking, for a server registration 2s 
and a server watermarking, and for a local watermark- 
ing and a server registration. 

[0006] J.-R Delaigle at al. (J.-R Delalgle. J.-M. Bouc- 
queau, J.^. Quisquater & B. Maoq, "Digital Images pro- 
tection techniques in a broadcast framework: An so 
overview", Laboratoire de Telecommunications et de 
T6l6d6ction, University Catholique de Louvain) have 
applied signature labelling techniques for the copyright 
protection of digital images. Their approach is based on 
an enhanced Image format and generates a digital sig- 3S 
nature label in front of the image. This signature label 
can be easily ovenwritten or destroyed. 
[0007] It is an objective of the present invention to pro- 
vide a system of the type mentioned initially that pro- 
vides a sinple and secure way of generating and 40 
transmitting watermarked data 

[0008] In one aspect of the invention, this object is 
achieved by using an asymmetric private and public key 
pair, as it is used in cryptography The original data set 
(cover data set, cover image) is watermarked, wherein 45 
the watermark is encoded using one or both of said 
keys. The watermarked data set (stego data set stego 
image) is then transmitted to a second party, wherein 
the same keys are used for estat^lishing a secure trans- 
mtssion between the parties. This simplifies the admin- so 
istration of keys since the only keys required are the key 
pair mentioned above. In addition to this, because cryp- 
tographic keys are less prone to guessing attacks than 
simple passwords, the security of the watermark is 
improved. 55 
[0009] In a preferred emtx)diment. both parties use 
asymmetric key pairs and a key protocol for establishing 
a common key between tfiem. 



(001 0] The party creating the watermark can emt>ed a 
private as well as a public watermark in the data set, 
wherein the private watermark is derived from the pri- 
vate key, the public watermark from the public key The 
public watermark can be detected by third parties while 
the private watermark can only be detected using pri- 
vate information. Preferably, the private watermark is 
not derived from the private key directly but from a hash 
value of the same, such that the author of the water- 
3 mark does not have to reveal his private key if the pri- 
vate watermark is to be verified. 
[0011] In a further aspect of the invention, the author 
of the watermark is again provided with an asymmetric 
cryptographic key pair. He embeds a message together 
with its cryptographic signature in the watermark When 
verifying this watermark, the presence of the signature 
increases reliability because it proves that the message 
was signed by the author. 

(001 2] In yet another aspect of the invention . the cover 
data set is provided with a digital watermark arxJ then 
transmitted to a registration party that permanently 
stores at least a hash value, time information and origin 
of the stego data set. 

[0013] In another aspect of the invention, a template 
modulation pattern is added to the Rouria" transform of 
an image that is to be provided with a watermark. For . 
checking the watermark, the Fourier transform of the 
stego-image is calculated. From this Fourier transform, 
the log polar mapping transfomi is generated, which is 
then searched for the modulation pattern. Using the log 
polar trartsform of the Fourier transform has the advan- 
tage that scaling and rotation of the stego image are 
expressed in translations. This allows an easy search 
for rotation and scaling using cross-correlation tech- 
niques. 

[0014] In still another aspect of the invention, the 
image to be watermarked is divided into blocks and the 
magnitude components of the Fourier transform of each 
block is modulated using the same pattern. This method 
provides robustness against cropping of the stego- 
image because a cropping leads to a circular translation 
in each block Preferably, the magnitude componerrts of 
tiie Fourier transform are modulated, wherein the sign 
of the modulation should be derived from the phase 
components, thereby reducing interference between the 
image data and the watermark as explained in the fol- 
lowing discfosura 

[0015] Further aspects, advantages and applications 
of the irrvention are described in the claims and the fol- 
lowing description, which description makes reference 
to the figures. They show: 

Fig. 1 the parties involved in individual watermark 
protection, 

Fig. 2 tiie parties involved in watermark protection 
using registered cryptographic keys. 
Rg. 3 the parties involved in watermark protection 
using registered cryptographic keys and a registra- 
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tion party, 

Fig. 4 the steps taken for embedding a watermark. 

Rg. 5 ttie steps for generating the template. 

Fig. 6 the steps for reading a watermark. 

Fig. 7 the steps for reading the template, s 

Fig. 8 the tiling of the watermark in a stego-image, 

and 

Fig. 9 the tiling of the watermark in a cropped 
stego-image. 

70 

I. Terms and Symbols: 

[O016] Before describing a preferred method and 
apparatus according to the invention, some key terms 
and symtx>is used in its description are explained in the is 
following: 

" Image ": An image in either digital or physical form 
which may constitute a still image or a video frame. 
It can also refer other types of data, such as video 20 
and sound, in particular when being used wnthin the 
context of the protection and owner authentication 
methods of section II of the disclosure. 
" Signal ": A signal in either digital or physical form. It 
may refer to one dimensional or multidimensional 25 
signals such as image and video. 
" Image Copyright Holder fICHr : A party (or a proc- 
ess acting on behalf of it) "owning" a digital image. 
This is the party that generates the watermarks. 
" Image Buver OBV : A party (or a process acting on 30 
behalf it) which obtains (e.g: by purchase) via elec- 
tronic means a specific image from the ICH. 
"Image Authentication P rocess flAP)": A process 
for verifying that the image has been processed 
(generation, storage, retrieval, modification, trans- as 
mission) before by the ICH. 

" Image Authentication Data flAOr : The authentica- 
tion data used in the lAR 

" Steoo ": Implies that an image or data is marked 
(i.e. it has an IAD embedded in it). The stego image 4o 
is also referred to as the stego data set. 
" Cover ": Implies that an image or data is unmarked 
(i.e. it has no IAD embedded in it). The cover image 
is also referred to as the cover data set. 
"Watermark" : The form the IAD takes when it is in a 45 
form suitable for embedding in a signal. 
" Image Copyr ight Office flCOr: An organization (or 
a process which acting on behalf it) which registers 
ownership for a specific image. Successful registra- 
tion is teased on a veriTication procedure, eg. by so 
checking the name and postal address of CH, infor- 
mation how ownership was acquired, the title of the 
image, a description of the type of image (artistic, 
literary, musical, dramatic) and date and place of 
first publication. After successful registration a dig- ss 
(tal copyright certificate can be generated, 
" Digital coovrioht certificate ": Digital copyright data 
which conrprise the copyright certificate data and a 



digital signature. 

" Copyright R pqHPj=i t Data (CRD) ": Copyright data 
whicfi contains the stego image, the image ID of the 
cover image, a Universal Copyright Convention 
Notice, a Copyright Symbol, the term "Copyright", 
the year of the copyright, the name of the copyright 
holder, and the phrase "All Rights Reserved". 
"Cop yright Cprtifirats Data (CCD) ": Copyright data 
which contains at least an image ID. a hash value of 
tiie digital iniage. a time stamp, a Universal Copy- 
right Convention Notice, a Copyright Symbol, the 
term "Copyright", the year of the copyright, ttie 
name of the copyright holder, and the phrase "All 
Rights Reserved". 

" Dioital signature ": A data string which has been 
generated by a digital signature generation trans- 
formation. 

" Digital signature generation transformation": A 
method for producing a digital signature. 
" Digital sinnature verification transformation": A 
method for verifying whether a digital signature is 
authentic or not 

" Digital sign ature scheme": A scheme leased on 
asymmetric cryptographic techniques whose pri- 
vate transformation is used for the digital signature 
generation and whose public transformation is used 
for the digital signature verification. 
" Digrtal sigp attire schema with message reCQverY": 
A digital signature scheme for which a priori knowl- 
edge of the input data is not required for the signa- 
ture verification transformation. 
" Digital signature scheme with a ppendix": A digital 
signature scheme for which the input data is 
required as input to the digital signature verification 
transformation. 

"Asymmetric key pair ": A pair of related crypto- 
graphic keys where the private key defines the pri- 
vate transformation and the public key defines the 
put3lic transformation. 

"Symmeti-ic key ": A cryptographic key used with a 
symmetric cryptographic technique and known only 
to a set of specified entities. 

" Asymmetric kev agree ment orotocor: A protocol 
whereby a shared symmetric key becomes availa- 
ble to two parties for subsequent cryptographic use. 
The symmeti-ic key is exchanged on the basis of a 
digital signature scheme with message recovery. 
The signed keys are encrypted witii an asymmetric 
public key. 

" Public Key Infrastructure fPKD" : An organization 
(or processes wfiich acts on behalf of it) which 
offers services for the generation, registration, cer- 
tification, distribution, validation, and revocation of a 
certificate associated with an asymmetric key pair. 
" Public watermark ": A watermark tiiat can be 
detected using a publidy available key (or a hash 
value thereof). . 

" Private watermark ": A watermark that can only be 
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detected using a secret key (or a hash va)ue 
thereof). It is not possible for an unauthorized third 
party to overwrite or delete the private watermark 
without the cryptographic secret keying information. 
" Embedded authentication data ": The hidden IAD. 
" Pavload ": The core of the hidden IAD in bit form 
without error control coding applied. 
" Image ID ": The following format scheme for a glo- 
bally unique ID: The first 3 bytes determine the ICO. 
the following 3 bytes determine the ICH ID defined 
by the ICO. Finally the ICH can freely assign last 4 
bytes for each one of his digital images. 
" Oblivious ": A watermarking technique which does 
not require the cover image for extracting the mark. 
In other words, only the stego image is required to 
extract the mark when using an ol>livious marking 
scheme. 

"Template": A hidden message encoded ,in the 
image. By detecting the template, the scaling 
(zooming) and rotation suffered by a stego-image 
can be determined. 

"Pseudo r andom seed ": A value used to initialize a 
psetxlo random number generator. 

Symbols: 

[001 7] 

H distinguished (unique) .name of the Image Copy- 
right Holder H 

0 distinguished name of the Image Copyright 
Office O 

B distinguished name of the Image Buyer B 

1 distinguished name of the Public Key Infrastruc- 
ture ; 
Certn entity H"s putJiic key certificate from I 

Certo entity O's public key certificate from I 
Certg entity B's public key certificate from I 
(Px .vx) t*ie elliptic curve key pair, with a key size of 
at least 209 bits, of an entity with the distinguished < 
name X. See Alfred J. Menezes. Paul C. Van Oor- 
schot. and Scott A. Vanstone. "Handbook of 
Applied Cryptography". CRC Press. 1996. ISBN 0- 
8493-8523-7 

CC a copyright certificate 4 
KS key size of the elliptic curve pair 
DSSMRq(X.Y.Z) an elliptic curve based digital sig- 
nature generation scheme with message recovery, 
where X denotes the private key. Y the input data to 
be signed, and Z the resulting signature. Si 
DSSMRv(X,Y,Z) an elliptic curve based digital sig- 
nature verification scheme with message recovery, 
where X denotes the public key, Y the input data, 
and 2 the resulting output data. 

DSSAPq(X.Y,Z) an elliptic cun^e based digital sig- Si 
nature generation scheme with appendix, where X 
denotes the private key, Y the input data to be 
signed, and Z tine resulting signature. 



DSSAPv(X.YZ) an elliptic curve based digital sig- 
nature verification scheme with appendix, where X 
denotes the public key, Y the input data, and Z the 
resulting output data. 
' KxY a secret key for a symmetric cryptosystem 

shared between two entities with the distinguished 
name X and Y. 

Kxy{Data] denotes the cipher text generated by a 
symmetric cryptosystem with plain text Data. 
0 . crh a collision resistant hash function 

AKAP(X.Y,KxY.pSx .VSy. pCx. VCx.pSy. VSy. pCy, VCy) 

applied asymmetric key agreement protocol (see 
ISO/IEC 1 1 770-3, "Information technology-Security 
techniques-Key management. Part 3: mechanisms 

s using asymmetric techniques") with entity X's pri- 
vate signature key pSx, entity X's public verification 
key vsx. entity X's private dedperment key pCx. 
entity X's public endpherment key vcy. entity Y's 
private signatijre key psy, entity Y's public verifica- 

J tion key vSy entity Y's private dedpherment key 
pCyi and entity Y's public encipherment key vcy 
between the entities with the distinguished name X 
and Y After tiie protocol was successfully executed, 
the two entities have agreed on a Kxy- 
0IAE(X,Y,CI, SI) the oblivious image owner authen- 
tication embedding algorithm with the seed X. the 
paytoad Y, the cover image CI, and the resulting 
stego image SI. 

OIAV(X.SI,Y) the oblivious image owner authenti- 
cation detection algorithm with the seed X. the 
stego image SI. and the resulting payload Y) 
TVP time-variant parameter, such as a random 
number, a time-stamp, or a sequence number. 
II concatenation of two data elements in ttiis order. 
CI Cover Image 
SI Stego Image 

II. Protection arxl owner authentication: 

[0018] Depending on the proof-level to be provided for 
the protection, the preferred embodiment of the appara- 
tus and method according to the invention provides 
three different levels of reliability, which are t>ased on 
each other, namely: individual watermark protection, 
watermark protection with registered cryptographic 
keys, and watermark protection with an ICO on the 
basis of registered cryptographic keys. 
[001 9] The present method and apparatus is based on 
an image owner authentication technique, described 
below, which ^beds and detects the IAD as the pay- 
load of a watermark. The applied image owner authen- 
tication technique is based on a perceptuEdly adaptive 
spread spectrum technique which provides reliatile 
means of embedding robust watermarks. Such a tech- 
nique will be discussed in section III. In addition, a 
spread spectrum techniques is a form of symmetric 
cryptosystem. In order to embed or extract a water- 
marK it is necessary to know the exact values of the 
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seed used to produce pseudo random sequences used 
to encode a watermark. The seeds are considered to be 
cryptographic keys for watermark generation and verifi- 
cation. System security can therefore be based on pro- 
prietary knowledge of the keys and provide in addition 5 
the necessary security parameters needed for a secure 
communication (mutual authentication, integrity, confi- 
dentiality, non-repudiation) in the trading process of dig- 
ital images. Because spread spectrum signals are 
statistically independent (and therefore virtually orthog- w 
onal). the present method and apparatus encodes more 
than one watermark in an image at the same time, 
namely private watermarks and public watermarks. The 
public watermarks indicate that the image is copyright 
material and provide information on true ownership. At is 
the same time there are secure private watermarks 
whose secrecy depends on the private key of the asym- 
metric key pair of the ICH. 

[0020] Since the system provides for the registration 
of th e public key of the asymmetric key pair, the ICH can 20 
prove that he is the only person in the possession of the 
adequate private key of the asymmetric key pair and. 
therefore, the generator of the private watermarks. 
[0021] The system also provides the secure registra- 
tion (mutual authentication, integrity, conftdentiality. 25 
non-repudiation) of watermark encoded images (data 
sets) at an ICO. The stego image is registered at the 
ICO and a digital copyright certificate is generated 
which is signed by the ICO. If an unauthorized third 
party has also encoded watermarks in the same image, 30 
corrf licting claims in copyright disputes can be resolved. 
Examining the time stamps of the copyright certificate 
enables the secure identification of the legal owner: The 
earii est of the time stamps identifies the legal owner if 
no copyright revocation request has been applied. 35 
[0022] Watermark protection with registered crypto- 
graphic keys and the ICO based copyright protection 
are based on a PKI. The PKI issues on request public 
key certificates containing the public key of the party, 
the distinguished name of the party, and a time stamp. 40 
Every certificate is signed wHh the PKI's private key and 
the trust is built on the validity of the authentic copy of 
the PKI's public key (we assume that the public key of 
the PKI is accessible, authentically distributed, and ver- 
ifiable by every party). 45 
[0023] In the following the three levels of the system 
are described. 

a) IndivkJual watermark protection 

so 

[0024] As Shown in Fig. 1 . the apparatus for the indi- 
vidual copyright protection is partitioned into two proc- 
esses, namely the ICH with the distinguished name H 
and the IB process with the distinguished name B. Sup- 
pose (psh.vsh) and (pCn. vch) are the elliptic curve key ss 
pairs of H, (psb.vsb) and (pCg. vcb) are the elliptic curve 
key pairs of B. Suppose H has an authentic copy of vSb. 
vcq and B has an authentic copy of vsh, vch before they 



start any communication. 

[0025] The following phases are applied by the proc- 
esses of the individual copyright protection apparatus: 

Phase 1 : 

H retrieves the cover image CI. generates a unique 
image identifier IDci. stores IDci. and retrieves the key 
pair (psh.vsh). 

Phase 2 (generating private watermark): 
[0026] 

1. H generates a private lADci applying 

DSSMRg(PSh. IDci. IADci). 

2. H partitions, depending on the key size KS, the 
lADct into different blocks BL}, 1 ^ i ^ P. with a length 
of 128 bits (P := flADci /KS\ This ensures that the 
blocks to be included in each watermark are suffi- 
ciently small. 

3. H generates the stego image SI applying for 
every i, 1 ^ i < P, using the transformation: 

OIAE(crh(pSH) XOR crh(i). BLj, Clj, Slj), 

where Clj denotes the cover image (stego Image 
from the previous iteration. Cl^ := CI) and Slj 
denotes the stego image of iteration I. The resulting 
stego image is then SI := Sip Set CI* := SI. 

Phase 3 (qengratinq pwbifc vygtermarK); 

[0027] H generates a public IADqi applying 

DSSMRg(psh. CD, lADci), 

with CD := "Copyright byHHHTVPH "All Rights 
Reserved". 

H again partitions, depending on the key size KS, the 
lADci into different blocks BL^, 1 5 i ^ P, with a length of 
128 bits (P :=riADci/KST). 

H generates the stego image SI applying for every 
i ^ P, the following transformation: 

01AE(crh(vsH) XOR crh(i), 6^. Clj. Slj). 

wh^e Clj is the cover image (stego image from the pre- 
vious iteration, Cl^ = Cr, with CI* from the previous 
phase) and Slj is the stego image of iteration i. The 
resulting stego image is SI = Sip 

Phase 4: 

H stores the resulting stego image SI and may generate 
a signed copyright certificate. 
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Phase 5: 

H and B execute the following steps for the trading of 
copyright protected digital images: 

5 

1 . H and B execLrte 

AKAP{H, B. Khb. PSh. vsh- P^h. vch. psg. vsb. 

PCb. VCb) 

10 

for the generation of a shared symmetric session 
key Khb- 

2. B generates the trading transaction T1, 

T1 := (KHBETDIISigTOj). with is 
TD := IDcil|TVP||B||H. and 
DSSAPg(psb. TD SigTD). 

B then transmits T1 to H. 

3. H receives T1. deciphers Khb[TDH SigTD], and 20 
verifies TD, applying 

DSSAPv<vSb, SigTD IVR) 

where IVR denotes the intermediate verification 25 
result. If 

IVR = crh{TD). with TD := IDci||TVP||B||H. 

then TD has been successfully verified and the next 30 
step shall be executed. In any other case, the 
processing and communication between the H and 
B is stopped.- 

4. If the verification was successful. H retrieves with 
the IDc, information the corresponding stego image as 
SI and generates the trading transaction 

T2 := (KHBlTDIISigTD]), with 

TD := SI |!TVP||H|1B. and DSSAPq(psh. TD^ 

SigTD). ' 40 

H then transmits T2 to B. 

5- B receives T2. deciphers KHB[TDI|SigTD]. and 
verifies TD. applying 

45 

DSSAPv(vsh. SigTD. IVR). 

where IVR denotes the intermediate verification 
resuh. If IVR = crhCTD). with TD := SI||TVP||H||B. 
then TD has been successfully verified. B then so 
checks the IAD applying for every i, 1 ^ i ^ P. the fol- 
lowing transformation: 

OIAV(crh(vsH) XOR crh(i). Si, PLj), 

ss 

where Slj denotes the stego image and PLj the 
detected payload of the i-th public watermark. (If P 
is not known, the procedure is iteratively applied 



until no more public watermark can be detected). 
The lADci is then generated by concatenating the 
PIh, i.e. 

IADc,:-PLi||PL2I|-||PLn. 1 <i5 P 
lAOci is then verified applying 

DSSMRv(vSh. IADci.OD). 
with OD as the output data. If OD is 

"Copyright by"||H|ITVP|| "All Rights Resented". 

B has verified H as the copyright holder, if the putalic 
watermarks have not been modified (overwritten). 

Remark: 

[0028] In the case of a legal copyright dispute, H can 
retrieve the IADqi and construct the corresponding 
unique image ID. Since the generation of the same 
asymmetric key pair by two distinguished entities is very 
unlikely, the construction of the unique image ID pro- 
vides a good level of proof against copyright infringe- 
ment. In the case of watermark protection with 
registered keys, the generation of the same asymmetric 
key pair by two distinguished entities can be prevented. 
[0029] Depending on the applied asymmetric scheme 
the private decipherment key may be identical to the pri- 
vate signature key and the public encipherment key may 
be identical with the public verification key. 

b) Watermark protection with registered keys: 

[0030] As shown in Rg. 2. the apparatus for the copy- 
right protection with registered cryptographic keys is 
partitioned into three processes, namely the ICH with 
the name H. the IB process with the name B, and the 
PKI process with the name I. Suppose (psh^vsh). 
(PCh.vch). (psb. vsb). (PCb. vcb). {pS|. vsj. and (pC|,vC|) 
are the unique elliptic curve key pairs of H, B. and I, 
respectively Suppose H has an authentic and actual 
copy of Certs which signature was verified with the 
authentic copy of vS| and the B has an authentic and 
actual copy of Certn which signature was verified with 
the authentic copy of vS|. Then the same phases as for 
the individual watermark protection apparatus have to 
be applied. 

Remark: 

[0031] Since the generated asymmetric key pairs are 
unique, the ICH can be uniquely identified if no addi- 
tional watermarks by unauthorized persons have been 
encoded into the SI of the ICH. The ICO b>ased water- 
mark protection provides the necessary counter meas- 
ures to prevent this threat. 
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c) ICO based watermark protection: 

[0032] As shown in Fig. 3. he apparatus for the ICO 
based watermark protection is partitioned into four proc- 
esses, namely the ICH with the name H, the IB process s 
with the name B. the PKI process with the name I. and 
the ICO process with the name O. Suppose (psh.vSh). 
(PCh. vc^i. (psb.vsb). (pcg. vcg). (ps|.vs,) (pc,. vc,). (psq, 
vSq). and (pCq.vCo) are the unique elliptic curve key 
pairs of H, B, I and G, respectively H has an authentic *o 
copy of Certg and Certo whose signatures were verified 
with the authentic copy of vs|. B has an authentic copy 
of CertH and Certo whose signatures were verified with 
the authentic copy of vs], and O has an authentic copy 
of Certn and Certg whose signatures were verified with i5 
the authentic copy of vs). 

[0033] The following phases are applied by the proc- 
esses of the ICO based copyright protection apparatus: 

Phase 1 to Phase 3: See Phase 1 to Phase 3 of the Indi- 20 
vidual watermark protection. 

Phase 4: 

H stores the resulting stego image SI. zs 
Phase 5: 

H and O execute the following steps for the secure reg- 
istration or validation of copyright requests, and the gen- 30 
eration of copyright certificates. 

1 . H and O execute 

AKAP(H. O. Kho. PSh. vSh. PCh. vch. PSq. vsq. 35 

pCo. VCo) 

for the generation of a shared symmetric session 
key Khb- 

2. H retrieves the CRD and generates the copyright 40 
request CR, 

CR := (KHB[TD|tSigTD] ). with 

TD := CRD||TVP1|H||0. and DSSAPqCpsh- TD. 

SigTD). 45 

H then transmits CR to O. 

3. O receives CR. deciphers KHB[TD||SigTD]. and 
verifies TD. applying 

so 

DSSAPv(vSh. SigTD. IVR) 

where IVR denotes the intermediate verification 
result. If 

55 

IVR = crtifTD). with TD := CRDt|TVP||H||0, 
then TD has been successfully verified and the next 



step shall be executed. In any other case, the 
processing and communication between the H and 
O is stopped. O verifies the CRD with respect to 
legal copyright issues (uniqueness, originality, etc.). 
If the data has been successfully verified then the 
next step shall be executed. In any other case, the 
processing and communication between the H and 
O is stopped. 

4. If verification was successful. O generates the 
corresponding digital copyright certificate executing 

DSSAPg(PSo. CCD. SigCCD). 

O then stores the copyright certificate CC := 
CCDllSigCC and generates then the Copyright 
Confirmation Reply CCR 

CCR := (KHo[TDI!SigTD] >, with 

TD := CC1!TVP|P||H. and DSSAPqCpsq. TD. 

SigTD). 

O then transmits CCR to H. 

5. H receives CCR. deciphers KHotTDH SigTD], and 
verifies TD, applying 

DSSAPv(vSh. SigTD. IVR). 

where IVR denotes the Intermediate verification 
result. If IVR = crhCTD). with TD := CC||TVP||0||H, 
then TD has been successfully verified. H then ver- 
ifies and stores the CC. 

The following phase can now be executed repeat- 
edly, if necessary, without repetition of the previous 
phases. 

Phase 6: 

H and B execute the following steps for the trading of 
copyright protected digital images: 

1. H and B execute 

AKAP(H. B. Khb. PSh. vsh. PCh. vCh. pss. vsg. 

PCb. VCb) 

for the generation of a shared symmetric session 
key Khb- 

2. 8 generates the trading transaction T1 , 

T1 := {KHBfTD[|SigTD]>, with 

TD := IDcilITVP|lB||H, and DSSAPg(psb, TD 

SigTD). 

B then transmits T1 to H. 

3. H receives Tl. deciphers KHsFDIISigTD]. and 
verifies TD, applying 

DSSAPv(vsb. SigTD IVR) 
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where IVR denotes the intermediate verification 
result. If 

IVR = crh(TD). with TO := IDci||TVPi|B|IH. 

then TD has been successfully verified and the next 
step shall be executed. In any other case, the 
processing and communication between the H and 
B is stopped- 

4. If the verification was successful. H retrieves with 
the IDci information the corresponding stego image 
SI and generates the trading transaction 

T2 := <KHBn"D||SigTD]). with 
TD := SI ||TVP||H|1B. and DSSAPq(pSh TD 
SigTD). 

H then transmits T2 to B. 

5. B receives T2. deciphers KHBn"D||SigTD], and 
verifies TD, applying 

DSSAPv(vsh. SigTD, IVR). 

where IVR denotes the intermediate verification 
result If IVR = crh(TD). with TD := SI||TVP|IH||B. 
then TD has been successfully verified. B stores 
then the SL 

Remark: 

[0034] B may check the copyright certificate request- 
ing O to transfer an authentic copy of the copyright cer- 
tificate for a given image identifier IDc|. Except the data 
transferred, the applied protocol is the same as 
described in phase 4. 

[0035] If B would like to transfer a specific copyright of 
a CI to another legal party, he may initiate a copyright 
revocation request with O. The different phases of this 
request are analogue to the copyright request 
[0036] The method described in this section II 
requires a suitable watermarking technique. Various 
such techniques are known and can be employed. How- 
ever, a preferred technique is described in the next sec- 
tion. 

III. Embedding the watermarks 

[0037] The watermarking technique described here 
comprises the following steps: 

a) An error-control coding technique for the mes- 
sage to be transmitted in the watermark; 

b) A encoding technique to encode the message 
resulting from step a); 

c) A reliable method for embedding tiie encoded 
message from step b) in the image without intro- 
ducing visitjie artifacts. 



[0038] Each of these three aspects can be applied to 
conventional watermarking techniques. Preferably, they 
are used in combination to provide a highly reliable, 
robust and powerful method for marking data sets. This 
5 method can be applied for any watermarking applica- 
tions, in particular to the application described in section 
It of this disclosure. 

[0039] Steps a) and b) can be used for embedding 
watermarks in any type of data while step c) is opti- 
10 mized for embedding watermarks in images. 

[0040] In the following, the three elements of the 
watermarking technique are described in detail. 

Ill.a) Error control coding 

15 

[0041 ] Error control coding is applied to the message 
prior to encoding step Ill.a). When used in combination 
with the procedure described in section II, the message 
corresponds to one of the t>locks BLj. 
20 [0042] Preferably symtDol based Reed Solomon (RS) 
codes are applied for this purpose. The advantages are 
the following: 

RS codes correct symbol errors rather than bit 
25 errors, and 

RS codes can correct erasures as well as errors. 
Erasures can be factored out of the key equation, 
which means that "erased" symbols can be 
ignored. They do not play any role in the error con- 
30 trol mechanism - an erasure Is useless redurxJancy. 

[0043] Being able to discard erased symbols has two 
advantages: 

35 - If the posterior protjability of a received symbol is 
low, it may be ignored. 

RS codes only come in standard sizes. For exam- 
ple a 255 x 8 bit code is common. Most conrvnonly 
used RS error control codes appear to be too large 
40 to be used in watennarking. However, it is possible 
to make almost any RS code fit a watermarking 
application by judiciously selecting symtxils as 
being erased (because they were never embedded 
in the image in the first place). 

45 

lll.b) Encoding the message 

[0044] During encoding, the message to be transmit- 
ted in the watermark is transformed into a form suited 
so for t>eing used in the modulation of Image components. 
At the same time, rt is encrypted i^ing a suTtat>le key. 
[0045] If used with the method of section II, the encod- 
ing procedure has access to the cryptographic keys pn 
and vh (or tiieir hash values), which are applied as 
55 seeds to generate pseudo-random sequences as 
described below. The public key is used for encoding 
the message of the public watermark, the private key is 
used for the private watermark. Knowledge of the cone- 
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spending key (or hash value) is required for recovering 
the message from the watermark. 
[004-6] A watermark may be embedded or extracted by 
the key owner In this form spread spectrum Is a sym- 
metric key cryptosystem. From the point of view of 
embedding watermarks In images given the crypto- 
graphic keys the sequences themselves can be gener- 
ated. A good spread spectrum sequence is one which 
combines desirable statistical properties such as uni- 
formly low cross correlation with cryptographic security. 
[004-7] Suppose we are given a message B (e.g. that 
was provided with error coding in above step 11 1. a). The 
message has the binary form bitjg - bL. where bi are its 
bits. This can be written in the form of a set of symtxjis 
SiSg . . .Sfji • most generally by a change in a number 
base from 2 to B. The next stage is to encode each synn- 
bol Sj in the form of a pseudo random vector of length N, 
wherein each element of this vector either takes the 
value 0 or 1 . N is e.g. in the order of 1000 to 10000 (typ- 
ically in the order of 10% of the total number of image 
coefficients (Fourier components) that can. theoreti- 
cally, be modulated). 

[0048] In a preferred embodiment, this is carried out 
by using a pseudo random generator seeded by the key 
crh(pH) or crti(vH). 

[0049] To encode the first symbol a pseudo random 
sequence v of length N + B - 1 is generated. To encode 
a symbol of values where 0 < s < B the elements Vg, Vg^t 
... Vg+N-i are extracted as a vector of length N, For the 
next symbol another independent pseudo random 
sequence is generated and the symbol encoded as a 
random vector Each successive symbol is encoded 
in the same way. Note that even if the same symtx^l 
occurs in different positions in the sequence, no colli- 
sion is possible because the random sequences used to 
encode them are different - In fact they are statistically 
independent. Finally the entire sequence of symbols is 
encoded as the sumnnation: 



{0050} The pseudo-random vector m has N elements, 
each varying between 0 and M. In a next step, the ele- 
nrients of tn are offset to make their mean zero. These 
elennents will determine the strength of modulation of 
the Fourier components of the image in step ItLc. 
[0051] When decoding the watermark, a vector m' 
(read-out message) is derived from the stego-image. In 
oblivious watermarking, m' corresponds to the modu- 
lated Fourier coefficients. Hence, in general m' will not 
be equal but "similar" to m. 

[0052] To decode s from m*. the elements of m' are 
first offset to make their mean zero. Then, starting from 
the (known) seed, the first random sequence v of length 
N + B - 1 is generated and the correlation of v with m' is 
calculated. The peak of the correlation indicates the off- 



set Si in the random sequence that was used for gener- 
ating rv Then, the next random sequence v is 
generated and cross-correlated with m' to retrieve S2, 
etc. 

5 [0053] Reliatjie communications of the apparatus are 
best accommodated by using m-sequences that pos- 
sess minimum cross correlation with each other. This is 
the same as maximizing the Euclidean distance 
between vectors V1.v2.v3.... 

10 [0054] If M is sufficiently large, the statistical distribu- 
tion of the message m should approach a Gaussian 
(Central Limit Theorem). A Gaussian distributed water- 
mark has the advantage that it is more difficult to detect. 
The variance increases with order M^^; in other words, 

15 the expected peak excursion of the sequence is only 
order M^^. 

Ill.c) Embedding the message in the Image 

20 [0055] In this step, the encoded message m (e.g. as 
otjtained in the previous step) is applied to the image for 
generating the waternnark. 

[0056] In contrast to steps lll.a) and lll.b). embedding 
the message in the image requires some knowledge of 

25 the nature of the data stored in the image. In the follow- 
ing, the image is assumed to be a two-dimensional 
image. The method is optimized for robustness against 
operations generally applied to images such as transla- 
tion, cropping, rotating, scaling. (The method is not opti- 

30 mized for other types of data, such as sound or text) 
[0057] In order to achieve robustness against circular 
translation, the image block is first subjected to a Fou- 
rier transform. Then, message m is used to modulate 
the Fourier components. In addition to this, a template is 

35 embedded in the image, which template can be used for 
detecting a rotation and scaling of the image when read- 
ing the watermark. A tiling mechanism and suitable 
phase-dependent correction are applied for providing 
robustness against cropping. 

40 [0058] Figure 4 shows a detailed diagram describing 
the embedding of the watermark. Calculation starts 
from the cover image: 

1. If the image is a color image, tiien compute the 
45 luminance component (by replaang each pixel by 

g/2 -I- r/3 + b/6. where g. r arxJ b are its green, red 
and blue components) and use these values'for the 
foUowing calculations. 

2. Divide the image into adjacent blodcs of size 1 28 
50 x 128 pixels. 

3. Map the image luminance levels (or gray levels 
for a black and white inrtage) because it corre- 
sponds to a perceptually llat" domain by replacing 
them with their logarithm. The logarithm is a good 

55 choice because it corresponds of the Weber-Fech- 
ner law which describes the response of the human 
visual system to changes of luminance. 

4. Compute the FFT (Fast Fourier Transform) of 
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each block. From the real and imaginary compo- 
nents obtained In this way, calculate corresponding 
magnitude and phase components. The magnitude 
components are translation invariant and will there- 
fore be used in the following modulation steps. 
(However, it is possible to derive translation invari- 
ants from the phase spectrum as well, which could 
also be modulated). 

5. Select the magnitude components to be modu- 
lated. To encode a message m of length N, a total 
number of N components are modulated. In non- 
oblivious watermarking, any components can be 
modulated. For oblivious watermarking, because of 
interference of the cover image with the watermark, 
the largest (highest energy) components (at about 
. the lowest 10% of the frequencies) are avoided and 
components at medium frequencies (about next 
30%) are used. These figures are chosen because 
they generally give a good compromise between 
robustness and visibility of the watermark. There 
are two methods for selecting the components to be 
modulated: 

a) The selection of the components to be mod- 
ulated does not depend on the given image. 
Rather, the same components are selected for 
every image. The author as well as the reader 
of the wateroTark know the positions of the 
connponents to be selected in advance. 

b) The largest components (inside the allowa- 
ble frequency range) are used for modulation. 

When selecting the components to be modulated, 
care must be taken to preserve the symmetry 
imposed on the Fourier components F(ki. k2) by 
the fact that tiie image block is real valued: 

F(ki.k2)=F-(Ni-ki. Na-ka) 
(where N^, designate the size of the image 
block). Once the magnitude components (M^. ... 
Mn) to be modulated are chosen, the correspond- - 
ing value mj of message m is added to or sub- 
tracted from the corresponding selected nriagnitude 
component Mj. Addition is used, if the correspond- 
ing phase connponent Pj is t>etween 0 and n, sub- 
traction if it is between n and 2jl This provides * 
robustness against translation and cropping (see 
below). 

Before adding/subtracting the values mj to/from Mj. 
the vector m can be scaled to adjust the magnitude 
of its elements to those of the components M,. f 
Generally, the elements rrij should be in tine same 
order of magnitude as the components Mj. The 
depth of modulation or amplitude of the embedded 
signal should depend on the objective measure of 
the perceptual significance. The lower the perc^- s 
tual significance, the higher should be the ampli- 
tude of the watermark. However, for simplicity, the 
amplitude for all components is kept constant. 



6. Add a template by a second modulation of tiie 
magnitude components. This is described in more 
detail below. 

7. Compute the inverse FFT using the phase com- 
5 ponents and tiie modulated magnitude compo- 
nents. 

8. Compute the inverse of the perceptual mapping 
function of step 3. For Weber- Fechner law map- 
ping, the inverse function is an exponential. 

10 9. Replace each watermarked block in the image to 
obtain the stego image. 

10. If the image is a color image, then rescale tiie 
red, green and blue components by the relative 
change in luminance introduced by embedding a 
15 waternnark. Typically, the red. green and blue pixels 
occupy a byte each in program memory. If overflow 
or underflow occurs then the pixel is set to the 
upper bound 255 or lower bound 0 respectively. 

20 Template: 

[0059] As mentioned above, a template is added to 
the image in step 6. The steps for generating the tem- 
plate are illustrated in Fig. 5: 

2S 

20. Apply a log-polar map to the magnitude conpo- 
nents, i.e. transform them into a polar coordinate 
system (©, log-r) with logarithmic radius axis. 
In this representation, a scaling of the image leads 
30 to an offset of the components along the log-r axis. 
A rotation of the image leads to an offset along the 
0axis. 

Preferably, low pass filtering is used for interpolate 
ing tiie frequency space components during tiiis 

35 mapping. 

The magnitojde components belonging to very low 
or high frequencies are not mapped. The following 
modulation is only applied to components in 
medium frequency range. 

(0 21. Select the magnitude components in the log- 
polar coordinate system to be modulated. Typically, 
about 10% of all components are to be modulated. 
The pattern T formed by the selected components 
in log polar space should be such that its auto-cor- 

5 relation under ti-anslation is weak. For this purpose, 
tiie indices of the selected components should be 
coprime or be derived from a two-dimensional ran- 
dom sequence. 

Each selected component is increased by a given 
0 value. 

22. Map the modulated points by change of coordi- 
nates back into frequency space. 

[0060] The pattern T formed by the selected conpo- 
s nents in log polar space is predefined and known to tfie 
reader of the watermark. 

[0061 ] It must be noted that the calculation of the log- 
polar ti-ansform is not required for generating the tem- 
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plate. Instead of this, the pattern T of the connponents to 
be modulated in log-polar space can be mapped back to 
frequency space, which results in a pattern T in fre- 
quency space that can be applied directly to (e.g. added 
to) the components in frequency space. 
[0062] As will be explained below, the template is not 
required for non-oblivious watermarking. 
[0063] Figure 6 shows a detailed diagram illustrating 
the steps for reading a watermark from the stego image: 

31. tf the image is a color image then compute the 
luminance component and use these values for the 
following calculations. 

32. Divide the image into adjacent blocks of size 
128 X 128. 

33. Map the image luminance levels (or gray levels) 
to the perceptually Hat" domain by replacing them 
with their logarithm. 

34. For each block compute the FFT 

35. Determine the rotation and scaling that the 
image suffered by finding the template in tog-polar 
space. This is described below. 

36- Using the results of step 35. read the modulated 
components to generate message m'. This requires 
the knowledge of the method that was used in step 
5 for selecting the components to be modulated. 

[0064] Once that the message m* is recovered, it is 
demodulated and error conrected using the methods 
described in sections lll.a) and lll.b). 

Rnding the template: 

[0065] The steps for finding the template are illus- 
trated in Fig. 7: 

40- Apply log-polar mapping to the magnitude com- 
ponents of the Fourier transform. The magnitude 
components belonging to very low or high frequen- 
cies are not mapped. The following analysis is only 
applied to components in medium frequency range 
41. For oblivious waternnarking, calculate the nor- 
malized cross correlation of the components in log- 
polar space with the template pattern T that was 
used for generating the template in step 21 and find 
the point of best correlation. H the image has nei- 
ther been rotated or scaled, this point is at zero. 
Scaling leads to a corresponding offset along the 
tog-r axis, rotation to a corresponding offset along 
the 0 axis. 

For non-otdivious watermarking, the log polar trans- 
form of the Fourier components of the cover image 
can be used instead of template pattern T for 
retrieving scaling and rotation. 
The cross correlation can be calculated efficiently 
using conventional Fourier techniques- 



Properties of the watermark: 

[0066] In the following, some of the properties of the 
watermark generated using the steps described above 
5 are discussed. 

Resistance to cropping: 

[0067] One feature of translation invariants developed 
10 using the Fourier transform is that they are invariant to 
circular translations, (or cyclic shifts). This is used to 
construct watermarks that are invariant to cropping. 
This is illustrated by reference to Rgs. 8 and 9. 
[0068] As mentioned above, the image is split into 
15 blocks and the watermark is applied to each block. In 
other words, the same modulation pattern is applied to 
the Fourier components of each block, wherein the 
modulation pattern is given by the corresponding 
encoded messages m. 
20 [0069] Fig. 8 shows such an image where the fat lines 
100 designate the borders between the trfocks. Sup- 
pose that the watermark in a standard size block will be 
of the form: 

25 T=[A B ; C D] 

where the submatrices A. B. C and D are of aitoi- 
trary size. A circular translation of such a watermark is 
of the form: 

30 

S=[D C ; B A]- 

[0070] The original stego image is tiled with water- 
marks in the pattern [T T T T ; T T T T :T T T T]. There- 

35 fore a cropped section of the matrix will canry a 
watermark in the form [S 8 S S ; S S 8 8 : S S S S]- This 
is illustrated in Figure 9- When reading the watermark of 
the cropped image of Fig. 9. each block canies the 
watermaric S. Since S is a circular transform of X it can 

40 be read without problenrrs in the Fourier domain using 
the steps outlined above. 

[0071 3 Note, however, that the cover image is not tiled, 
only the watermark is. Therefore, while cropping merely 
induces a circular translation of the watemnari< in each 

45 block, the change of image in each block is not a circular 
translation. To compensate for this, the phase compo- 
nents Pj of the Fourier transform must be used for cor- 
recting the sign of the modulation of the magnitude 
components Mj. as it is outlined under step 5 above. 

so [0072] The optimum size of Week depends on a 
numba- of cfifferent factors. A size that is a powa" of two 
is useful because the FFT can be used. The block size 
also must be small enough to withstand cropping but 
large enough to comfortably contain a watermark. The 

55 best conpromise for t>lock size is 1 28. 
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Resistance to scaling and rotation: 

(0073] As mentioned above, reading the template in 
. log-polar space allows to delect and measure any scal- 
ing and/or rotation that was applied to the Image. This s 
information can then be used for reading the watermark. 
Since the reader knows the pattern that was used for 
modulating the magnitude components in step 5. he can 
identify the modulated components in the scaled and 
rotated image and derive the message m' therefrom. io 
[0074] Note that the apparatus does not explicitly use 
a rotation and scale invariant watermark but instead 
searches the parameter space of rotations and scales. 
Since searching the space of rotation arKl scales in the 
frequency or space domain is quite complicated, the 75 
log-polar map is used where these parameters are Car- 
tesian coordinates and can be searched using efficient 
correlation techniques. 

Redundancy: 20 

[0075] The waitermark is embedded in blocks of a 
fixed size with exactly the same watermark embedded 
in each block. This means that the watermark can be 
recovered from a single block only. This leads to a 2s 
redundancy that increases the chance of extracting the 
watermark correctly from more than one block 

IV. Summary 

30 

[0076] The following summarizes some of the proper- 
ties of the preferred embodiments of the invention. 
[0077] The use of an asymmetric cryptographic key 
pair for the seed generation enables the execution of 
asymmetric key agreement protocols with message 35 
recovery or appendix and the protection of the commu- 
nication between the involved parties. Different security 
services for the communication, such as mutual authen- 
tication, integrity, confidentiedity and non-repudiation are 
supported by the system with one asymmetric crypto- 40 
graphic key pair of the watermark author only for a reg- 
istration or trading process 

[0078] The present technique enatiles a strong bind- 
ing relation between the image ID. the image, and the 
ICH if the ICH registers his copyright at the ICO. If an 4S 
image is watermarked later by an unauthorized person, 
the time stamp in the copyright certificates resolves the 
copyright ownership. 

[0079] The ICH does not have to reveal his private 
cryptographic key if ownership verification has to be so 
applied by a different legal party. 
[0080] The present technique supports transferral of 
copyrights. If copyright is transferred to another legal 
party, corresponding copyright revocation certificates 
may be generated. 55 
[0081] Digital signatures techniques are applied for 
the security of the communication between different 
parties and the authentication data embedded in a pri- 



vate or public watermark of an image. No signature 
labeling techniques of the complete image are applied 
by the system. 

[0082] The Fourier-Mellin transform has been 
enhanced as described above. The Fourier Mellin 
Transform is the Fourier Transform of a log polar map. In 
the present invention, the log polar map of a Fourier 
transform is used as a means of facilitating rotation and 
scaling invariance. 

[0083] Circular translation invariants are used as a 
means of constructing digital watermarks that are invar- 
iant to cropping. 

[0084] In contrast to some known techniques, the 
present system does not require a database of all 
watermarks that were ever emt>edded in image anyr 
where. 

[0085] Information is embedded and/or retrieved in 
the log polar domain of the Fourier transform. Fre- 
quency components are modulated which are oblivious 
to the cover image but which also have the property that 
they form an unambiguous non-repeated pattern in tog- 
polar space. They are used for deternrrining the degree ' 
of rotation and scaling suffered by a stego-image in the 
absence of the cover-image. Coprime frequencies are 
useful for generating such a pattern or terr^late. Uni- 
form random sampling of tog polar space is another 
method that can be applied. 

[0036] The technique aiDplies a new concept of invar- 
iants which are based on the modification of the well 
known FM transform and the coprime frequencies. 
[0087] The methods described above can be incorpo- 
rated into an apparatus, such as one or more comput- 
ers, using know programming and hardware 
techniques. To prove the feasibility of the approach, a 
Java based copyright protection and authentication 
environment for digital images has been implemented. 
The PKI. the ICH, the ICO, and the IB application proc- 
esses all implement a Graphical User Interface and a 
server, supporting tx3th console users and other 
requests through a socket interface. 

Claims 

1 . A method for generating and transmitting a data set 
between two parties H and B conp rising the steps 
of 

a) providing a cover data set (CI) correspond- 
ing to the data set to be transmitted. 

b) generating a stego data set (Si) of said cover 
data set (CI) by embedding at least one digital 
watermark in said cover data set (Cf). wherein 
said watermark is encoded using at least one 
key of an asymmetric cryptographic key pair 
(PSh. vsh) of H. said key pair comprising a 
secret private key (pSn) and a known public key 
(vsh) derived therefrom, 

c) establishing a cryptographically secure 
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transmission between parties H and B with a 
key protocol using at least said key pair (pSH. 
vsh) of H. 

d) transmitting said stego data set (SI) from 
said party H to said party B within sard secure 
transmission. 

2. The method of daim 1 , wherein said cryptographi- 
cally secure transmission between said parties H 
and B is established using an asymmetric key pro- 
tocol (AKAP(H.B.KH8.psH.vsH.pSB,vse)) based on 
said key pair (psh. vsh) of H and a private and pub- 
lic asymmetric cryptographic key pair (pse- vsa) of 
B for generating a common key (Khb) between said 
parties H and B. 

3. The method of one of the preceding claims wherein 
said key pair (psh. vsh) of H is an elliptic curve key 
pair. 

4. The method of one of the preceding dainns wherein 
said step b) further comprises the steps of 

generatifig at least one private watermark, 
wherein said private watermark is encoded 
using said private key (pSn) of.H, and prefera- 
bly also 

generating at least one putilic watermark, 
wherein said public watermark is encoded 
using said public key (vsh) of H. 

5. The method of claim 4 wherein said private water- 
mark is encoded using a hash value (crh(psH)) of 
said private key (psh) and can be decoded by using 
said hash value (crh(pSH)). 

6. The metttod of one of the preceding daims wherein 
said step b) comprises the step of generating at 
least one public watermark, wherein said public 
watermark is encoded using a hash value 
(crh(vsH)) of said public key (vsh) of H. 

7. The method of one of the preceding daims wherein 
said step b) comprises the steps of 

i) providing a message (s^. Sa Sm) to be 

transmitted in said at least one watermark, said 
message consisting of a plurality of symtx)ls. 

ii) providing a pseudo rarxlom generator 
seeded with a seed value derived from at least 
one key of said key pair (psn. vsh) of H or a 
hash value thereof. 

iiO encoding said message using values from 
said pseudo random generator. 

8. The method of claims 7 wherein said step iii) com- 
prises 



for each of said symtwis (Sj). calculating a sym- 
bol vector (rj), wherein all elements of said vec- 
tor are derived from numbers from said pseudo 
random generator, 
5 adding said symbol vectors (ti) to generate an 

encoded message (m) and using said encoded 
message for embedding said watermark. 

9. The method of claim 8 wherein for each of said 
10 symbols (Sj) said pseudo random generator is used 

for generating a pseudo random sequence of num- 
bers (vi. vg. — ). and wherein the value of said sym- 
bol (Si) is used for selecting a sub-sequence within 
said pseudo random sequence for forming said 
IS symbol vector (fj). 

10. The method of one of the claims 8 or 9 comprising 
the following steps for decoding said watermark: 

20 extracting a read-out message (m') from said 

watermark, said read-out message being a 
vector having the same length, if erased ele- 
ments are replaced by zero, as said symt>ol 
vectors (rj, 

25 generating alt possible values of said symbol 

vectors {r) using said pseudo random genera- 
tor seeded with said seed and calculating the 
correlation between all said possible values 
and said read-out message (m*). 

30 

1 1 . The method of daims 9 and 10 comprising the step 
of calculating the cross-correlation between said 
pseudo random sequences of numbers (v^. V2. — ) 
and said read-out message (m') for retrienng said 

35 symbols (sJ. 

12. The method of one of the preceding daims com- 
prising the step of encoding a message for being 
embedded in said waternnark by using symbol 

40 based Reed Solomon codes. 

1 3. The method of one of the preceding daims charac- 
terized in that said step b) further comprises the 
step of calculating a logarithm of said cover data set 

45 (CI) before embedding said watermark for embed- 
ding said watermark in a perceptually flat domain. 

14. Method for generating a stego data set (SI) of a 
cover data set (CQ espedally for step b) of one of 

so the preceding claims comprising the steps of 

generating at least one message (lADci), 
applying a digital signature to said message 
(lADci) using an asymmetric cryptographic key 
55 pair (Ph. Vh). 

generating said stego data set (SI) of said 
cover data set (CI) by generating at least one 
digital watermark in said cover data set (CI), 
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wherein said watermark contains said mes- 
sage (lADci). 

15. Method for generating and transmitting a data set 
between two parties H and B, especially of one of s 
the preceding claims, comprising the steps of 

providing a cover data set (CI) corresponding 

to the data set to be transmitted, 

generating a stego data set (SI) of said cover w 

data set (CI) at a party H by generating at least 

one digital watermark in said cover data set 

(CI). 

transmitting said stego data set (SI) to a regis- 
tration party (O), and is 
permanently storing certification data (CCD) at 
said registration party (O), said certification 
data comprising a hash value of said stego 
data set (SI), a digital time stamp (TVP) and 
information designating said party H. 20 

16. The method of daim 15 further conprising the 
steps of generating a digital signature of said certi- 
fication data (CCD) using an asymmetric crypto- 
graphic key pair (pso. vsq) of said registration party 25 
(O), transmitting said certification data (CCD) and 
said digital signature to said party H, and verifying 
said digital signature at said party H by using a pub- 
lic key (vso) of said key pair of said registration 
party. 30 

1 7. Method for generating and verifying a watermark In 
a cover data set (CI) representing a cover image, 
especially for step b) of one of the preceding 
claims, comprising the following steps for generat- 35 
ing said watermark 



Fourier components of said stego image for 
evaluating a scaling and/or rotation factor. 

1 8. The method of claim 1 7 wherein said step B) further 
comprises the steps of 

calculating a log-polar transform of said com- 
ponents of said cover image for generating log- 
polar components, 

modulating said log polar components using a 
log-polar transform (T) of said modulation pat- 
tern (T). 

19. Method for generating a watermark in a cover data 
set (CI) representing a cover image especially for 
one of the preceding claims, characterized by the 
step of dividing said image into a plurality of adja- 
cent blocks and by the following steps carried out 
for each block: 

calculating the Fourier transform of the block of 
the block, and 

modulating at least part of the magnitude com- 
ponents of the Fourier transform of the block 
using a modulation pattern, wherein the same 
modulation pattern is used for all blocks. 

20. The method of daim 19, wherein the nrtodulation 
pattern determines values to be added and/or sub- 
tracted for each of said magnitude components and 
wherein, at each frequency, the corresponding 
phase component of the Fourier transform is used 
for determining if said value is to be added or sub- 
tracted from said magnitude component. 



A) calculating the Fourier transform of at least 
part of said cover image for generating Fourier 
components of said cover image, and 40 

B) modulating at least part of said Fourier com- 
ponents using a template modulation pattern 
(T). 

C) using the inverse Fourier transform for gen- 
erating a stego image, 45 
said method further comprising the following 
steps for verifying said waternnark in a possibly 
scaled and/or rotated version of said stego 
image, 

D) calculating the Fourier transform of the pos- so 
siWy scaled and/or rotated version of said 
stego Image for generating Fourier compo- 
nents of said stego image, 

E) calculating a log-polar transform of said f=6u- 
rier components of said stego image, and ss 

F) calculating the cross correlation between a 
log-polar transform (T) of said modulation pat- 
tern (T) and said log-polar transform of said 
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calculating the Fourier transform of part of the data set 
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